2011: The beginning of the end for digital forensic recovery?

In late December 2010 I published a paper with Richard Boddington in the Journal of Digital Forensics, Security and Law, describing how modern SSD firmware designs invalidate one of the key ideas underlying forensic recovery and analysis of data. This paper has been well received by practitioners and the media.

Presently, police forces and workplace investigators have a well-established system for managing digital evidence found on hard drives, which has been used for decades. Unfortunately, if they approach SSD drives the same way, they can accidentally ruin the evidence and there is no indication that anything has happened. This can have the consequence of making guilty people seem innocent, and innocent people seem guilty, amongst other difficulties.

The nice thing about this paper's result is that you can easily reproduce it at home without a big budget or forensic software. The links below point to some of the media articles describing our work.

The paper is free to download (Click here) and I've written a Frequently Asked Questions guide to accompany it, which you can download here: (FAQ).